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Efficient Quantum Key Distribution With Trines 
Of Reference- Frame- Free Qubits 
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Abstract. - We propose a rotationally- invariant quantum key distribution scheme that uses a pair 
of orthogonal qubit trines, realized as mixed states of three physical qubits. The measurement 
outcomes do not depend on how Alice and Bob choose their individual reference frames. The 
efficient key generation by two-way communication produces two independent raw keys, a bit key 
and a trit key. For a noiseless channel, Alice and Bob get a total of 0.573 key bits per trine state 
sent (98% of the Shannon limit). This exceeds by a considerable amount the yield of standard 
trine schemes, which ideally attain half a key bit per trine state. Eavesdropping introduces an 
e-fraction of unbiased noise, ensured by twirling if necessary. The security analysis reveals an 
asymmetry in Eve's conditioned ancillas for Alice and Bob resulting from their inequivalent roles 
in the key generation. Upon simplifying the analysis by a plausible symmetry assumption, we find 
that a secret key can be generated if the noise is below the threshold set by e = 0.197. 



Introduction. — Mutually non-orthogonal quantum 
states are important in quantum key distribution (QKD) 
because such states cannot be completely distinguished 
from each other and hence they are intentionally used to 
transmit classical information while preventing eavesdrop- 
ping. For qubits, the qubit trine represents the smallest 
complete set of non-orthogonal states. Earlier trine-based 
protocols include the schemes by Bechmann-Pasquinucci 
and Peres [1] and by Phoenix, Barnett, and Chefles [2]. 

When QKD is performed, it is generally assumed that 
Alice and Bob share a common reference frame, the precise 
nature of which depends on the specific information carri- 
ers involved. For instance, correct orientation of Alice and 
Bob's coordinates is necessary for proper alignment of the 
preparation and measurement apparatus. Practical imple- 
mentations of cryptographic protocols require establishing 
a rigid shared frame in advance or a frequent automatic re- 
alignment. A lack of a shared reference frame is equivalent 
to the presence of decoherence in the quantum channel [3] . 

In this contribution, we describe a trine-based crypto- 
graphic protocol that uses reference-frame-free qubits and 
a novel scheme for key generation. We report the asymp- 



totic noise threshold below which this QKD procedure is 
secure. The security analysis involves a very plausible, yet 
unproven, simplifying symmetry assumption. 

Basics of trine schemes. — A qubit trine is rep- 
resented by a symmetric set of three states lying in the 
XZ-planc of the Bloch sphere, where adjacent vectors are 
separated by 120°; see fig. [T] Let us call the qubit trine 
T = {\A),\B),\C)}. Alice prepares her qubits in any one 
of the trine states with equal probability, and sends these 
qubits one at a time to Bob. Bob measures the qubits he 
receives with a probability operator measurement (POM) 
whose outcomes are not projectors to the trine T, such 
as |^4)(^4| but rather to states orthogonal to T, i.e., states 
belonging to the set T = {\A'), \B'), \C')}, where 

|(AL4')| 2 = 0, \{A\B')\ 2 = \{A\C')\ 2 = \, (1) 

with analogous relations holding for \B) and |C). Since 
Alice works only with the trine T while Bob is concerned 
only with states from the complementary trine T' , we can 
simplify matters by treating corresponding states of T and 
T" as identical. For example, if Alice sends A, we say Bob 
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Fig. 1: Qubit trine T and complementary trine T' in the Bloch 
representation. The projectors on the respective kets are all 
symbolized by vectors in the XZ-plane. 



never measures A but has equal probability of obtaining 
either B or C. In this description, the joint probabilities of 
the quantum communication channel are given by table [JJ 
for which 

I(A : B) = log 2 | = 0.585 (2) 

is the mutual information I (A : B) between Alice and 
Bob. With such a noiseless trine channel, then, they can 
generate up to 0.585 secret key bits per qubit sent. 

The double trine scheme. — If Alice and Bob use 
physical qubits for the logical qubits of the trine, they 
must be sure to agree on the coordinates for preparing 
and measuring their quantum signals. However, they can 
skip this problem altogether by using reference-frame-free 
(RFF) qubits. In our scheme a logical qubit is constructed 
by coupling three physical qubits. For concreteness, we 
consider the physical qubits to be spin-i particles (with 
|0) for spin-up and |1) for spin-down) and combine their 
angular momenta in the appropriate manner. 

Following the recipe of ref. [4], we consider two trines. 



In the subspace (j 
|Pi> 

\P2) 
\PS) 

and the states 

\9l) 

\Q2) 
l?3> 



h) we have the trine 



(|001)-|010))/V2, 
(|100>-|001»/\/2, 
(|010)-|100))/V2, 



(|101) 
(|110) 

noiD 



(3) 



|110»/V2, 
|011»/V2, 

|ioi))A/2, 



m 



(4) 
i). All 

relevant states are in the 3 = \ sector of the three spin-i 
atoms and, for the sake of simplifying the notation, we 
shall consistently ignore the empty j = § sector. 



constitute the trine in the subspace (j 



Table 1: Joint probabilities for the noiseless trine channel. 
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The sums of the projectors to corresponding p- and te- 
states are 



W i = \p i )( Pi \ + \q i )(q i \ = S jk 



(5) 



where Sjk projects on the singlet sector for atoms j and 
k, and the indices ijk pertain to all cyclic permutations 
of 123. By construction, the WjS are rotationally invari- 
ant and hence have the same properties for all reference 
frames — they are RFF operators. We note that the WjS 
have two eigenvalues and two eigenvalues 1, so that Wi 
and 1 — Wi project on orthogonal two-dimensional sub- 
spaces, and 
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tr{W l }=2, tv{WiWj} = 



35i 



1 



(6) 

are identities that will be relevant in what follows. 

Because our scheme has two independent sets of trines, 
we call it the double trine scheme. It works as follows. 
Alice sends a random sequence of the states Pi = \Wi to 
Bob, with the three states occurring with equal frequency, 
and Bob measures them with a POM whose outcomes are 
n? — 1(1 — Wj). The resulting joint probabilities, 



Pij = ^ tr {p* n j} 



1 



(7) 



are those of table [TJ 



Signal and idler qubit. — The sum of the three 
p-kets of ([3]) vanishes — they are linearly dependent be- 
cause the j = m = 4 sector is two-dimensional. A pair 



-), | — h) of orthogonal kets is identified by 

1 / 1 LO L 



{\pi),\P2),\ P3 )) = (\ ++),[-+))■ 



where 



(l9i) 



V2 V 1 u 

exp(i27r/3), and likewise we have 



l93» = (I 



V2 V 1 



LO 2 LO 



(8) 



(9) 



for the q-states. We regard the four orthogonal states |±±) 
that span the j = i sectors of the three spin-i atoms as 
two-qubits states [4] whereby, for example, ket | H — ) has 
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the signal qubit in the '+' state and the idler qubit in the 
'— ' state. 

The signal states \A), \ B), \C) that we identify as 

(l^|s) 1 |C}) = (| + ),|-))^=(l" 2 f ) (10) 

form the single-qubit trine that matters. Upon denoting 
the Pauli operators of the signal qubit by X, Y, and Z 
and identifying |±) with the eigenkets of Y = iXZ, the 
signal-qubit trine is in the XZ plane as depicted in fig. [TJ 
In view of 

Wi = \A){A\®l, W 2 = \B){B\®1, W 3 = \C){C\®l i 

(11) 

the idler sector is completely irrelevant: Alice encodes the 
information in the signal qubit only and Bob's POM does 
not probe the idler qubit at all. The sole purpose of the 
idler qubit is to render possible the construction of the ro- 
tationally invariant signal qubit. We can. therefore, think 
of the double trine scheme as a generic scheme of the kind 
described in the context of fig. [JJ with the signal qubit 
carrying the quantum state from Alice to Bob. 

Common source scenario. — Rather than having 
Alice prepare qubits in the trine states and send them to 
Bob, who then analyzes them with the trine POM, we 
can generate the joint probabilities of table [1] in a more 
symmetric and largely equivalent way. In this alternative 
scenario, a source distributes entangled two-qubit states 
to Alice and Bob. 

Ideally, the two signal qubits are in their singlet state 
that is described by the statistical operator 

po = \s)(s\ with | S ) = (12) 

On their respective qubits, Alice and Bob then both mea- 
sure the same trine POM with the outcomes 

IIi = |*>|<*l fori = A,B,C. (13) 

Indeed, the resulting joint probabilities, 

Pjk = tr{Uj ® n fe po } for j, k = A,B,C, (14) 

are those of table [1] 

In the security analysis below, we shall assume that the 
source is controlled by eavesdropper Eve. Her activities 
will introduce noise into the quantum channel between 
Alice and Bob, but they are only accepting qubits from a 
source that looks like the singlet of (112[) with an admixture 
of unbiased noise, 

Pe = \ s )(l-e)(s\ + l (15) 

with < e < 1. 

As far as Alice and Bob are concerned, the noise param- 
eter e characterizes the channel. In the presence of noise, 



Table 2: Joint probabilities for the noisy trine channel. 
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they observe errors in the trine channel: sometimes they 
get the same measurement outcome for a particular qubit 
pair, which does not happen in the noise-free case. Rather 
than the noise- free joint probabilities of table [TJ they now 
have the probabilities of table [21 

But since their measurements yield only these nine joint 
probabilities, Alice and Bob cannot determine all fifteen 
parameters that specify the two-qubit state distributed by 
the source. In this respect, the trine schemes are markedly 
different from tomographic protocols [5], such as the six- 
state protocol [6] or the Singapore protocol [7], in which 
full tomography of the source state is central. 

If Alice and Bob do not see the symmetric probabil- 
ity table [U they enforce the symmetry by twirling. For 
this purpose, they carry out random bilateral rotations on 
the qubits that leave the singlet component intact while 
removing any bias from the noise. 

Efficient generation of the raw dual key. Once 
Alice and Bob finish collecting and measuring their qubits, 
they get a paired record of measurement results. Next, 
they communicate over an authenticated public channel 
to discuss the raw data and distill a cryptographic key. 
Here we describe a new key generation method that yields 
mutual information between Alice and Bob closer to the 
Shannon limit for a trine-based channel [8] . We illustrate 
the procedure with the sample results shown in table [31 

To begin, Alice chooses two time slots in a specified or- 
der where her outcomes are different. Suppose she selects 
columns 2 and 5 in table [3] Alice's pair of letters in these 
positions is CB. She tells Bob to look at his record at those 
two particular time slots and he finds he has A in both. 
He declares he has the same letter in both positions. Alice 
quickly determines this letter to be A since it is the only 
result consistent with the expected outcomes for a trine 
protocol. Both record A for the key. Because there are 
three possibilities in this scenario, we call this the trit key. 
Alice and Bob discard the used time slots. 

There is another situation to consider. Say for the next 
round, Alice chooses columns 1 and 4. Bob finds BC for 
these time slots and announces the following: Record for 
BC and 1 for CB. Since Alice has AB, she infers that Bob 
must have BC, and both of them record for the key. In 
this case, there are two possibilities, so we call it the bit 
key. Note that the order of the time slots selected matters: 
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Table 3: Example of measurement records for Alice and Bob. 

1 2 3 4 5 6 7 
Alice A C C B B A C 
Bob B A A C A C B 



they would both record 1 if Alice reversed the order. 

The two situations — the trit case and the bit case — 
are mutually exclusive events so the bit and trit keys are 
independently built up from the raw data. In the noiseless 
case, the trit case happens \ of the time while the bit case 
happens in the remaining | . It follows that the number of 
key bits, per qubit exchanged, that Alice and Bob share 
in the key sequences thus generated is given by 



I(A : B) 



1 



log 2 3 + - log 2 2 = 0.573 , (16) 



which is 98% of the Shannon limit in (|2|). 

Noise in the channel leads to errors in the shared keys, 
since the unexpected result of getting the same letter dur- 
ing transmission will sometimes occur. The probability 
that the next letter pair contributes an entry to the trit 
key is now p t rit = ^(3 — e)(l + e), and the probability of 
contributing to the bit key is pbit = ^[(3 — e) 2 + 4e]. 

In the trit case, the correctly matched pairs in the key 
(that is, both Alice and Bob write down the same letter, 
whether A, B, or C) each have probability (3 — e)/(9 + 9e); 
the other six outcomes where they disagree have proba- 
bility 2e/(9 + 9e) each. Likewise in the bit case, the two 
instances when Alice and Bob agree both have probability 
i(3 — e) 2 /[(3 — e) 2 + 4e], while for the other two where they 
disagree the probability is 2e/[(3 — e) 2 + 4e] each. 

These probabilities yield 



I tlit (A : B) = 



IuM : B) 



3-e , 3-e 
-log 2 — 

i 2e 
log 2 



3 + 3e 
4e 



3 + 3e 



1 + e 



(3- e >* 2(3 - e) * 



(3-e) 2 +4e b2 (3 - e) 2 + 4e 

4e 8e 
+ (3-e) 2 +4e ° 8 ' 2 (3 - e) 2 + 4e 



(17) 



for the resulting mutual information between Alice and 
Bob for the two key sequences. For e = 0.1, their weighted 
sum ^(ptrit-^trit + Pbit-^bit) equals 96.4% of the Shannon 
limit, the mutual information of the joint probabilities in 
table As functions of e, /bit (A : B) and /trit (A : B) are 
the monotonously decreasing curves in figs. [2] and [3] below, 
respectively. 

Security analysis. — Eve is given full control of the 
source and is allowed to keep a quantum record, encoded 
in ancilla states, of what is sent. We write the source state 
in the form 



where, for example, | H — E2) is the '+' state of (fTT)|) for 
Alice's signal qubit, the '— ' state for Bob's, and Eve's 
ancilla in state l-E^)- When Alice's POM gives the jth 
outcome, and Bob's the fcth, the reduced ancilla state is 
described by \Ejj-) where j and k independently take on 
values of A, B, or C. After accounting for the coefficients 
in ([TUJ) and (fig]), we have 



(u-i- k \ 

-3+k 1 
\ Uj3+ k J 



(19) 



with ^4BC=012 for the j and k values in the exponents. 
The joint probabilities of table impose the constraints 



Pjk - (Ejk\E jk ] 
which in turn imply 



e 3 — e 

= 9 jfe + ^ ( 3h) 



(20) 



+ (E 2 \E 2 ) + (E 3 \E 3 ) + {E A \E A ) = 1 , 
(£a|£ 2 ) + (E 3 \E 4 ) = = (^^3) + (E 2 \E 4 ) , 
(E 1 \E A }=0, (E 2 \E 3 ) = -(l-e)/2. (21) 

These determine nine of the 16 real parameters that spec- 
ify the positive 4x4 matrix of the (Ej\Ek) amplitudes. 

A convenient choice of the remaining seven real param- 
eters is given by representing the kets \Ei), . . . , \E 4 ) by 
the columns of a matrix of the form [9] 



V 



where a 1 ,a 2 , 





Xa 2 


— pia 2 


°\ 





r x cos 


-r 2 e^ sin6» 










— r 2 cos 6 





\o 




-X*a t 


a 2 J 



(22) 



i, 9 are real and A, \i are complex, and 



their values are subject to 

(1 + |A| 2 + | M | 2 ) (a\ + al) +rl+rl 
A>(a 2 + a%) + r 1 r 2 e i ^ sin(26») 



As demonstrated by 

a i = a 2 = 

= 0, sin(20) = 



:V2 



2 - 2e 



(23) 



A = /1 = , 
(24) 



\S) = 



Ei 



— En 



- + E 3 



--E, 



(18) 



for which Alice and Bob's reduced two-qubit state is p e 
of (fl~5|) . there surely are permissible values, but it is not 
obvious which set of parameters is optimal for Eve. With 
the aid of p^|) . each permissible V matrix gives us valid 
column representations for the \Ejk)s. 

In fact, Eve is not interested in distinguishing the \Ej k ) 
states themselves but rather the two-ancilla states that are 
associated with symbols in the key sequences, whereby the 
bit and trit cases need to be considered separately. 
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In the bit case, the two-ancilla state conditioned on Alice 
concluding that Bob has the letter sequence 'j'fc' is given 

by 

Pjk* x \EkjEik){EkjEik\ + \EijEjk)(EijEjk\ 

+ \EkjEjk)(EkjEjk\ + \EkkEij)(EkkEij\ 

+ \EikEjj) (EikEjj \ + \EkkEjj)(EkkEjj\ , (25) 

where jkl can be any permutation of ABC . The first three 
terms account for the cases in which Alice and Bob record 
the same bit value, and the bit errors are covered by the 
last three terms. For example, the first term is for the 
situation when Alice has l kV and Bob has l jk' while both 
have l kj' for the last term. Eve has to tell p\£' and pjf^ 
apart when Bob announces that his letters are 'j' and 'fc'. 

Analogously, in the trit case, we have the conditioned 
two-ancilla state 



pf ] cx lEkjE^iEkjE^ 



\EijE kj ){EijE kj \ 
+ \EkkEik) (EkkEik \ + \EikEkk)(EikEkk\ 
+\E kl Eu){E H Eu\ + \EuE H ){E u E H \ (26) 

when Alice concludes that Bob has letter 'j' twice, with 
the first two terms accounting for a correct assignment 
and the remaining four terms for errors. Here, too, jkl is 
a permutation of ABC, and Eve need to distinguish the 
three states p A , p^ B \ and p^ 



(A) 

The six Pj k s and three p } s account for 54 of the 81 
two-ancilla kets \Ej k Eji k i) . This is as it should be because 
the remaining 27 kets are those for which Alice has the 
same letter twice, and this situation does not occur. 

If Eve eavesdrops on Bob, the conditioned two-ancilla 
states arc different. In the bit case we have 

Pjk x \E k jEi k )(E k jEik\ + \EijEj k )(EijEj k \ 

+ \E k jEj k )(E k jEj k \ + \EijE kk )(EijE kk \ 
+\EjjEi k )(EjjEi k \ + \E jj E kk )(E :jj E kk \ , (27) 

and the states 

pf cx \E kj Eij)(E k jEij\ + \EijE k j)(EijE k j\ 
+ 1 Ejj E tj ) (Ejj Eij\ + \ Eij Ejj ) (Ey E 3j \ 
+ \E n E k3 )(E n E k3 \ + \E k] E n )(E k] E n \ (28) 

apply in the trit case. They differ from their respective 
counterparts by the error terms. Therefore, we explore 
both sets of ancilla states to see whether Eve gains any 
advantage by eavesdropping on either Alice or Bob, or if 
it does not make any difference to the optimal amount of 
information she can obtain. 

With the assignment of signal-qubit Pauli operators X , 
Y , Z discussed above in the context of (|10[) . the two-qubit 
state p AB that the source distributes to Alice and Bob is 
specified by the eight fixed expectations values 



(X A ) = (Z A ) = (X B ) = (Z B ) = 
(X A X B ) = {Z A Z B ) = -(1 - e) 
(X A Z B ) = (Z A X B ) = 



0. 



together with the seven adjustable expectation values 



1 I a i ~ a 2 > 

-((Y A ) ± (Yb» = r? _ r ,_ (|A|2 _ |M|2)(a? _ 4) ) 



(Y A Z B ) + i(Y A X B ) = 4\ ai a 2 , 
(Z A Y B ) + i(X A Y B ) = -Ap ai a 2 , 
(Y A Y B ) = 2(al + a 2 2 ) - 1 , 



(30) 



which reveal the physical significance of the seven free 
parameters in (f2"2")l . Alice and Bob cannot distinguish 
between p AB , X A X B p AB X A X B , Y A Y B p AB Y A Y B , and 
Z A Z B p AB Z A Z B , and Eve gets the same amount of infor- 
mation from the corresponding four sets of conditioned an- 
cilla states. It follows that Eve can just as well choose the 
parameters in (|2"2"|) such that p AB = X A X B p AB X A X B = 
Z A Z B p AB Z A Z B . Then, the six expectation values in (131)1) 
that involve a single Y vanish, which happens for 



'2 • 



1 2 • 



A = p, = . 



(31) 



Indeed, it is plausible, and supported by much numerical 
evidence, that a parameter choice that yields such a par- 
ticularly noisy p AB is advantageous for Eve because then 
the entanglement between her ancilla and the qubits for 
Alice and Bob is particularly strong. 

With (|3"Tj) , matrix V takes on the simple one-parameter 
form 






V o 



\ 

x —y 
y 
yfcj 



(32) 



(29) 



with < c < 2e and x ± y = y/2 - c± 2(1 - e). We re- 
turn to for c = e, while c = 2e and c = 2e — e 2 give 
the p AB s with minimal concurrence and maximal entropy, 
respectively; the p AB s for 2e + c > 2 are separable [10]. 

The following observation lends additional support to 
(I3T]) and (|3"2"1) : The resulting conditioned ancilla states are 
such that it does not matter which letter pairs l jk' and 
'fcj ' are to be distinguished in the bit case, or which letter 
'j' is the actual one in the trit case. Eve does not acquire 
better knowledge about a subset of key entries at the price 
of knowing less about other subsets. By contrast, such an 
asymmetry in her knowledge is typically the case if some 
of the single-Y expectation values in (j3"0"]) are nonzero. 

Accepting thus the hypothesis that it suffices to con- 
sider matrices V of the single-parameter form (|32|) . we 
take the resulting two-ancilla kets \Ej k ) and calculate the 
Holcvo- Schumacher- Westmoreland (HSW) bounds [11,12] 
on I(A : E) and I(B : E) as a function of c. After optimiz- 
ing the value of c for the given value of the noise parameter 
e, we obtain the monotonically increasing curves in figs. [2] 
and [3] for the bit key and the trit key, respectively. 

The e values for which these curves intersect the curves 
representing the corresponding I(A : B) of (fT7| determine 
the noise thresholds below which Alice and Bob can gener- 
ate a secret key from the raw key by the usual procedures 



G 



G. Tabia and B.-G. Englcrt 




c 



Fig. 2: Optimizing the one-parameter source state: Wiretap- 
per bound for Eve eavesdropping on the bit key. For Alice, the 
noise threshold is e = 0.197, where /bit = 0.560. The corre- 
sponding numbers for Bob are e = 0.170, /bit = 0.603. 




c 



Fig. 3: Optimizing the one-parameter source state: Wiretap- 
per bound for Eve eavesdropping on the trit key. For Alice, 
the noise threshold is e — 0.193, where / tr it = 0.618. The 
corresponding numbers for Bob are e = 0.150, /trit = 0.744. 



of error correction and privacy amplification [13]. Both in 
the bit case and in the trit case, the thresholds are higher 
when Eve is eavesdropping on Alice than on Bob. We 
could not find lower thresholds with any parameter values 
not restricted by the symmetry requirements ()3ip . 

Summary and discussion. — We described a basis- 
independent trine protocol for QKD that uses RFF signal 
qubits encoded in mixed states of three physical qubits. 
The protocol exploits a novel efficient key generation 
scheme that yields a dual alphabet key. We analyzed the 
security with a plausible symmetry assumption that sim- 
plifies the task to the optimization of a single parameter. 
As a consequence of the asymmetric roles played by them 
during the key generation, there are different noise thresh- 
olds for eavesdropping on Alice and Bob. 

The raw keys need to be processed before Alice and Bob 
share a secret key. For the error correction and the privacy 
amplification one of the raw keys serves as the error-free 
reference, and we choose Alice's key for this purpose be- 
cause then the higher thresholds apply. We conclude that 
a secret key can be generated for e < 0.197, and one should 
stay well below this threshold to have a good key bit rate. 

Regarding practical implementations of the scheme, we 
note that the production of entangled states is no routine 
matter, with the difficulty increasing rapidly with size. 
A practical system with a common source for Alice and 
Bob requires six entangled physical qubits for each trans- 
mission. It is easier to use the variant where Alice pre- 
pares the states and sends them to Bob as this requires 
only three qubits. As with other QKD protocols, photon 
polarization is the most likely candidate for the physical 
qubits. Alice could prepare three-photon trine states by 
first preparing two of the three photons in a Bell state and 
the third photon with random polarization; it is possible 
to achieve this by beginning with an entangled four-photon 
state and measuring the polarization of the fourth photon 



with a suitable POM. Bob's POM would then test if one of 
the three orthogonal Bell states is present for every trio of 
photons received from Alice. Given the limited efficiency 
of typical photodetectors, efficient detection of all three 
photons is a challenge though. 

* * * 
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